Natuzzi Data Breach

Natuzzi S.p.A., a globally recognized Italian furniture and leather goods manufacturer, was listed on the Everest ransomware group’s dark-web leak portal on October 27, 2026, in a listing identified through SOCRadar Dark Web Monitoring. The company maintains production facilities in Italy, Romania, and internationally, operates direct retail in dozens of countries, and is supported by a global dealer network, giving this listing notable brand-recognition weight within Everest’s October 2026 disclosures, which included multiple Italian manufacturing targets. The breadth of Natuzzi’s manufacturing operations across multiple countries and its extensive dealer network expand the potential exfiltration value associated with the claim, factors that help explain why a globally recognized manufacturer of this profile attracts ransomware and extortion activity. The listing fits a period of sustained activity for Everest, which has claimed 34 victims over the past 60 days. The group’s most frequently targeted sectors during this period are Technology, Professional Services, and Manufacturing, and its leading victim geographies are the United States, Japan, and Italy. Other recent Everest listings include TECNA ICE, an Italian manufacturing company, alongside Kissei Shoji in Japan and Kennametal in the United States. Natuzzi therefore reinforces Everest’s documented concentration on Italian manufacturing targets and matches both the sector and geographic pattern of the group’s recent claims, making this listing consistent with, rather than an outlier to, the group’s current targeting behavior.

SOCRadar stealer-log telemetry for the natuzzi[.]com domain returned 25 records spanning 2024 to 2026. Within this dataset, 6 records are classified INTERNAL_AUTH_EMPLOYEE (category A), tied to Natuzzi-owned identity, payroll, NARES dealer portal, and federation infrastructure, while 3 records are classified THIRD_PARTY_SERVICE_CORPORATE_USER (category C), reflecting Natuzzi corporate email accounts on third-party SaaS platforms. Key observed endpoints include the NARES dealer portal login, the payroll platform, and the federation/SSO gateway. Notably, the most recent insert date is October 27, 2026 — the same day Natuzzi appeared on Everest’s leak portal. Exposure reaching back to 2024 indicates multi-year accumulation of Natuzzi credentials in underground credential markets rather than a single recent collection event. The breadth of the findings — identity, payroll, and dealer infrastructure spanning category A and C classifications across a 2024–2026 exposure window — is consistent with the credential landscape typically leveraged in enterprise ransomware intrusions. Credentials of this type could, if validated and reused, offer a path into corporate accounts and remote-access surfaces such as the federation/SSO gateway; this represents a plausible scenario consistent with the observed telemetry, not a confirmed intrusion method for this incident. The same-day insert date alongside the ransomware listing underscores how freshly circulated credentials can accompany extortion activity. Priority response areas focus on the exposed infrastructure: review of federation gateway access logs, NARES dealer portal authentication activity, and payroll system access. Dealer-network organizations that share authentication infrastructure with Natuzzi should independently assess their own credential exposure. The Everest claim itself remains alleged pending independent verification, and continued dark-web and stealer-log monitoring for additional Natuzzi credentials is advisable given that the listing surfaced through dark-web monitoring.